CBT Nuggets 30-minute webinar on Hadoop by Garth Schulte for a free

Join CBT Nuggets trainer Garth Schulte for a free, 30-minute webinar on Hadoop. He’ll discuss the popular platform that’s used to store and analyze large amounts of data. Garth will also answer questions from webinar participants, so be sure to mark your calendars!

The webinar is free, but registration is required. You can sign up below.

What: Hadoop webinar with Garth Schulte

When: 10 a.m. (Pacific Time) Thursday, Aug. 15

Register here.

Free webinar BackTrack and Kali Linux from CBT Nuggets trainer Keith Barker!

CBT Nuggets will be available webminar 30 minutes free on the BackTrack Linux and Kali.

The reason for this webinar to show the new training series on the BackTrack Linux and Kali.

Have you ever wondered what Kali Linux is, and how it can help you? Find out in a free 30-minute webinar with CBT Nuggets trainer Keith Barker!

Keith, creator of CBT Nuggets' "BackTrack and Kali Linux" training series, will give an overview of these valuable pentesting tools and will answer participants' questions. Don’t miss it!

What: BackTrack & Kali Linux webinar

When: 10 a.m. (Pacific Time), Wednesday, July 17

Register: To register, click here

Slide about Java EE 7 Platform Productivity++ and HTML5

Slides about Java EE 7 Platform  Productivity++ and HTML5

Java Platform, Enterprise Edition 7 (Java EE 7) is a major update of Java Enterprise Edition scheduled to be final in Q2 2013. Java EE 7 is specified in JSR 342.

It is important to note that the Java EE 7 specification and its underlying specifications are still work in progress and as such timing and exact content are subject to change

• Slides byArun Gupta
  Java EE & GlassFish Guy
  blogs.oracle.com
  /arungupta
  @arungupta

More in https://glassfish.java.net/javaee7/

Copyright © 2012, Oracle and/or its affiliates. All rights reserved.

Install Fedora 18 with Mate Desktop Environment

I will explain how to install Fedora 18 with the Mate Desktop Environment.

The explanation involves the minimum installation and use the internet to install the desktop environment.


We will need:

• A desktop/laptop/notebook (lol)
•  an image recorded on CD / DVD or usb fllash driver  image already prepared.
• Internet connection

When installing choose the minimal installation, choose this option to not fill the disc with packets descnecessário applications or files from any desktop environment.

After all the options have been chosen instalção and have completed the installation.

Let's log into the terminal and run the following commands: 

# yum install fedora-release-rawhide
# yum update -y
# reboot
# yum distro-sync -y
# reboot

# yum groupinstall "Mate Desktop" 

Let's create a user account

# useradd  USERNAME

# passwd USERNAME 

Once finalized we have to define what we want to boot the graphic environment.

#  ln -sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target  

What is a Denial of Service Attack?

What is a Denial of Service Attack? by

29C3 Cisco Phones Easy Hack

Hacking Cisco Phones

 Just because you are paranoid doesn't mean your phone isn't listening to everything you say

We discuss a set of 0-day kernel vulnerabilities in CNU (Cisco Native Unix), the operating system that powers all Cisco TNP IP phones. We demonstrate the reliable exploitation of all Cisco TNP phones via multiple vulnerabilities found in the CNU kernel. We demonstrate practical covert surveillance using constant, stealthy exfiltration of microphone data via a number of covert channels. We also demonstrate the worm-like propagation of our CNU malware, which can quickly compromise all vulnerable Cisco phones on the network. We discuss the feasibility of our attacks given physical access, internal network access and remote access across the internet. Lastly, we built on last year's presentation by discussing the feasibility of exploiting Cisco phones from compromised HP printers and vice versa.


Cisco PSIRT has assigned CVE Identifier CVE-2012-5445 to this issue.

IP Cisco Phones:

• Cisco Unified IP Phone 7975G
• Cisco Unified IP Phone 7971G-GE
• Cisco Unified IP Phone 7970G
• Cisco Unified IP Phone 7965G
• Cisco Unified IP Phone 7962G
• Cisco Unified IP Phone 7961G
• Cisco Unified IP Phone 7961G-GE
• Cisco Unified IP Phone 7945G
• Cisco Unified IP Phone 7942G
• Cisco Unified IP Phone 7941G
• Cisco Unified IP Phone 7941G-GE
• Cisco Unified IP Phone 7931G
• Cisco Unified IP Phone 7911G
• Cisco Unified IP Phone 7906

Presentation slides:

• Comapct Slides (142 Mb)

<Begin RNE Text>
Symptoms: Cisco Unified IP Phone 7900 series devices also referred to as Cisco TNP Phones contain an input validation vulnerability. A local, authenticated attacker with the ability to place a malicious binary on the phone could leverage this issue to elevate their privileges or take complete control of the device.
The issue is due to a failure to properly validate certain system calls made to the kernel of the device. This failure could allow the attacker to overwrite arbitrary portions of user or kernel space memory.
The following Cisco Unified IP Phone devices are affected: Cisco Unified IP Phone 7975G Cisco Unified IP Phone 7971G-GE Cisco Unified IP Phone 7970G Cisco Unified IP Phone 7965G Cisco Unified IP Phone 7962G Cisco Unified IP Phone 7961G Cisco Unified IP Phone 7961G-GE Cisco Unified IP Phone 7945G Cisco Unified IP Phone 7942G Cisco Unified IP Phone 7941G Cisco Unified IP Phone 7941G-GE Cisco Unified IP Phone 7931G Cisco Unified IP Phone 7911G Cisco Unified IP Phone 7906
The following models have reached end-of-life (EOL) status (for hardware only): Cisco Unified IP Phone 7971G-GE Cisco Unified IP Phone 7970G Cisco Unified IP Phone 7961G Cisco Unified IP Phone 7961G-GE Cisco Unified IP Phone 7941G Cisco Unified IP Phone 7941G-GE Cisco Unified IP Phone 7906
Refer to the following link to determine what product upgrade and substitution options are available: http://www.cisco.com/en/US/products/hw/phones/ps379/prodeolnotices_list.html
Conditions: Cisco Unified IP Phones within the 7900 Series running a version of Cisco IP Phone software prior to 9.3.1-ES10 are affected. The fixed software release is expected to be available for customers mid-to-late November 2012.
Workaround: Restrict SSH and CLI access to trusted users only. Administrators may consider leveraging 802.1x device authentication to prevent unauthorized devices or systems from accessing the voice network.
Further Problem Description: This issue was reported to Cisco PSIRT by Ang Cui of Columbia University. Cisco PSIRT would like to thank Ang and his staff for working with Cisco to resolve this issue.
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 6.8/5.6: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:L/AC:L/Au:S/C:C/I:C/A:C/E:F/RL:OF/RC:C
CVE ID CVE-2012-5445 has been assigned to document this issue.
Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/productssecurityvulnerability_policy.html
<End RNE Text>

source:  http://events.ccc.de/congress/2012/Fahrplan/events/5400.en.html

FIX for Oracle Java 7 Security Manager Bypass Vulnerability

Oracle launch  new version of Java for Oracle Java 7 Security Manager Bypass Vulnerability

Systems Affected

Any system using Oracle Java 7 (1.7, 1.7.0) including

• Java Platform Standard Edition 7 (Java SE 7)
• Java SE Development Kit (JDK 7)
• Java SE Runtime Environment (JRE 7)

All versions of Java 7 through update 10 are affected.  Web browsers using the Java 7 plug-in are at high risk.

Overview

A vulnerability in the way Java 7 restricts the permissions of Java applets could allow an attacker to execute arbitrary commands on a vulnerable system.

Description

A vulnerability in the Java Security Manager allows a Java applet to grant itself permission to execute arbitrary code. An attacker could use social engineering techniques to entice a user to visit a link to a website hosting a malicious Java applet. An attacker could also compromise a legitimate web site and upload a malicious Java applet (a "drive-by download" attack).
Any web browser using the Java 7 plug-in is affected. The Java Deployment Toolkit plug-in and Java Web Start can also be used as attack vectors.
Reports indicate this vulnerability is being actively exploited, and exploit code is publicly available.
Further technical details are available in Vulnerability Note VU#625617.

Impact

By convincing a user to load a malicious Java applet or Java Network Launching Protocol (JNLP) file, an attacker could execute arbitrary code on a vulnerable system with the privileges of the Java plug-in process.

Solution

Install new version Java Runtime Environment 7 Update 11.


Source :  http://www.us-cert.gov/cas/techalerts/TA13-010A.html